Search Vulnerabilities

FastGPT: Untrusted PR artifacts are pushed and deployed by privileged preview workflows

Parse Server - Arbitrary Code Execution via Malicious Version Tags

Parse Server - Unreviewed Code Execution via Malicious Version Tags

pnpm: Project env lockfile can short-circuit package-manager resolution and execute lockfile-selected pnpm bytes

pnpm: Repository-controlled configDependencies can select a pacquet native install engine

Angular: Multiple Remote Code Execution Vulnerabilities in Angular Language Service VS Code Extension

Download of code without integrity check in XCharge C6

electerm: Import unsafe bookmark data could lead to unsafe operation when click local type bookmark

The ConnectWise Automate™ Agent does not fully verify the authenticity of components obtained during plugin loading and self-update operations

apko doesn't verify downloaded apk packages against APKINDEX checksum (package substitution possible)

Lockfile checksums not verified in Hex allows dependency integrity bypass

Remote Code Execution in Ollama via Update Mechanism

Missing Signature Verification for Updates in Ollama

Improper TLS Certificate Validation RCE via Malicious Update in DeskTime Time Tracking App

Anviz Products Download of Code Without Integrity Check

A Download of Code Without Integrity Check vulnerability in the update modules in ASUS Member Center(华硕大厅) allows a local user to achieve privilege...

Axios npm Supply Chain Incident Impacting @usebruno/cli

TrueConf Client Update Integrity Verification Bypass

FastGPT has Arbitrary Code Execution in GitHub Actions via pull_request_target in fastgpt-preview-image.yml

ONNX Untrusted Model Repository Warnings Suppressed by silent=True in onnx.hub.load() — Silent Supply-Chain Attack